Elasticsearch Skill

Configures Elasticsearch for audit logging, full-text search, and analytics queries. This project uses Elasticsearch for audit trails (API key access, admin actions) and could extend to product search beyond PostgreSQL's TSVECTOR.

Quick Start

Elasticsearch Client Setup

typescript
1// src/services/elasticsearchService.ts
2import { Client } from '@elastic/elasticsearch';
3
4const client = new Client({
5  node: process.env.ELASTICSEARCH_URL || 'http://localhost:9200',
6  auth: {
7    apiKey: process.env.ELASTICSEARCH_API_KEY
8  }
9});
10
11export async function indexAuditEvent(event: AuditEvent): Promise<void> {
12  await client.index({
13    index: `audit-logs-${new Date().toISOString().slice(0, 7)}`, // Monthly indices
14    document: {
15      ...event,
16      '@timestamp': new Date().toISOString()
17    }
18  });
19}

Searching Audit Logs

typescript
1export async function searchAuditLogs(params: {
2  keyName?: string;
3  action?: string;
4  adminUserId?: number;
5  from?: string;
6  to?: string;
7  limit?: number;
8}): Promise<AuditEvent[]> {
9  const must: any[] = [];
10  
11  if (params.keyName) must.push({ term: { 'key_name.keyword': params.keyName } });
12  if (params.action) must.push({ term: { action: params.action } });
13  if (params.adminUserId) must.push({ term: { admin_user_id: params.adminUserId } });
14  
15  if (params.from || params.to) {
16    must.push({
17      range: {
18        '@timestamp': {
19          ...(params.from && { gte: params.from }),
20          ...(params.to && { lte: params.to })
21        }
22      }
23    });
24  }
25
26  const response = await client.search({
27    index: 'audit-logs-*',
28    query: { bool: { must } },
29    size: params.limit || 100,
30    sort: [{ '@timestamp': 'desc' }]
31  });
32
33  return response.hits.hits.map(hit => hit._source as AuditEvent);
34}

Key Concepts

Common Patterns

Index Template for Audit Logs

typescript
1await client.indices.putIndexTemplate({
2  name: 'audit-logs-template',
3  index_patterns: ['audit-logs-*'],
4  template: {
5    settings: {
6      number_of_shards: 1,
7      number_of_replicas: 0, // Dev; use 1+ in production
8      'index.lifecycle.name': 'audit-logs-policy'
9    },
10    mappings: {
11      properties: {
12        '@timestamp': { type: 'date' },
13        key_name: { type: 'keyword' },
14        action: { type: 'keyword' },
15        admin_user_id: { type: 'integer' },
16        admin_user_email: { type: 'keyword' },
17        ip_address: { type: 'ip' },
18        user_agent: { type: 'text' },
19        metadata: { type: 'object', enabled: false }
20      }
21    }
22  }
23});

Aggregation for Analytics

typescript
1const response = await client.search({
2  index: 'audit-logs-*',
3  size: 0,
4  aggs: {
5    actions_over_time: {
6      date_histogram: {
7        field: '@timestamp',
8        calendar_interval: 'day'
9      },
10      aggs: {
11        by_action: { terms: { field: 'action' } }
12      }
13    }
14  }
15});

See Also

• patterns - Index design, query patterns, bulk operations
• workflows - Setup, monitoring, troubleshooting

Related Skills

• See the postgresql skill for hybrid search strategies (Elasticsearch + PostgreSQL)
• See the docker skill for Elasticsearch container configuration
• See the node skill for async client patterns